AutoGPT prior to 0.6.52 allows users to supply computationally expensive Python/Jinja2 expressions to the Fill Text Template block. The backend sandboxing blocks unauthorized attribute access, but does not limit execution time or algorithmic complexity. An attacker can submit such expressions, causing excessive CPU and memory usage that can freeze or crash the server, resulting in a complete service outage and noisy‑neighbor effects.

The vulnerability affects all installations of Significant‑Gravitas AutoGPT with versions earlier than 0.6.52, regardless of deployment model, including self‑hosted or multi‑tenant environments.

The CVSS score of 7.7 indicates a high impact with medium to high exploitation difficulty. EPSS data is not available, and the vulnerability is not listed in CISA KEV, so the likelihood of exploitation is currently unknown but the potential impact is significant. The attack vector is inferred to be local or remote input to the Fill Text Template block, where an attacker can submit malicious expressions that will consume server resources until the process fails or is terminated.